#!/bin/sh /etc/rc.common

START=80

USE_PROCD=1
NAME=nac
PROG=/sbin/nac


callback () {   
            
  arptables  -A FORWARD -s $1 -j ACCEPT 
  arptables  -A FORWARD -d $1 -j ACCEPT 

   arptables  -A INPUT  -s $1 -j DROP
   arptables  -A OUTPUT -d $1 -j DROP

}  

start_service() {
#       /usr/local/natshell/nac/https/https_conf.sh
#        procd_open_instance
#        procd_set_param command "$PROG"
#        procd_close_instance



config_load devmode
config_get mode devmode  mode 

/bin/cp -rf /usr/local/natshell/nac/conf/nsapd.db  /tmp/.
/bin/cp -rf /usr/local/natshell/nac/conf/nac.db /tmp/.

sync
echo 3 > /proc/sys/vm/drop_caches

if [ $mode != 'nac' ] && [ $mode != 'cac' ]; then
exit
fi


config_load nac
config_get prt_type portal_cfg  prt_type
config_get nas NAC nas
config_get special_ip NAC special_ip

config_get net_mode NAC net_mode
config_get  freeall NAC  freeall
sysctl -w net.bridge.bridge-nf-call-arptables=0
if [ "$freeall" ==  "1" ]; then
    sysctl -w net.bridge.bridge-nf-call-arptables=1

    arptables  -F
    arptables  -P FORWARD  DROP  
 
    arptables  -A FORWARD -s 192.168.222.0/24 -j ACCEPT 
    arptables  -A FORWARD -d 192.168.222.0/24 -j ACCEPT 
    config_load wan_backup
    config_list_foreach  "policy" no_switch_ip callback

    /sbin/nac
    /usr/sbin/check_nac.sh  &
    exit
fi


if [ ! -d "/var/lib/nginx" ]; then
	mkdir -p /var/lib/nginx/
fi

if [ ! -d  "/var/log/nginx" ]; then
	mkdir -p /var/log/nginx/
fi

#init_nac=`/usr/sbin/init_nac_env.lua`
#if [ "$init_nac" == "-1" ]; then
#    exit
#elif [ "$init_nac" == "0" ]; then
#    nas_ip=""
#else
#    nas_ip="$init_nac"
#fi



up=`cat /proc/uptime | cut -d " " -f 1`
if [  $up -lt 5  ]; then
        sleep  20
fi


config_load network
config_get ipaddr lan ipaddr

uci set nac.NAC.portal_ip=$ipaddr
uci commit nac    



sysctl -w net.bridge.bridge-nf-call-iptables=1 

if [ "$special_ip" = "0.0.0.0" ] || [ "$special_ip" = "" ] ; then     
    /usr/sbin/iptables -t nat -D PREROUTING  -p tcp    --dport 80  -m mark --mark 50  -j REDIRECT --to-ports  14150
    /usr/sbin/iptables -t nat -A PREROUTING  -p tcp    --dport 80  -m mark --mark 50  -j REDIRECT --to-ports  14150
else
    /usr/sbin/iptables -t nat -D PREROUTING  -p tcp  -d $special_ip  --dport 80  -m mark --mark 50  -j REDIRECT --to-ports  14150
    /usr/sbin/iptables -t mangle -D PREROUTING -p tcp  ! -d $special_ip  -m mark --mark 50 -j DROP
    /usr/sbin/iptables -t nat -A PREROUTING  -p tcp  -d $special_ip  --dport 80  -m mark --mark 50  -j REDIRECT --to-ports  14150
    /usr/sbin/iptables -t mangle -A PREROUTING -p tcp  ! -d $special_ip  -m mark --mark 50 -j DROP
fi

  
  nackrn=`lsmod | grep nackrn`
while [ -z  "$nackrn"  ];do
        sleep  1
 echo "no found nackrn"
 insmod nackrn.ko    
 sysctl -w net.ipv4.ip_forward=0
 if [ "$nas" != "0.0.0.0" ]; then
         /sbin/nac
         killall  -9 check_nac.sh 
         /usr/sbin/check_nac.sh  &
         /usr/sbin/loopstart.sh   &
         sysctl -w net.ipv4.ip_forward=1
fi
nackrn=`lsmod | grep nackrn`      
done



}



stop_service() {
#       nginx_pid=`cat /tmp/nac_https_nginx.pid`
#       [ $? -eq 0 ] && [ -n $nginx_pid ] && kill -9 $nginx_pid &&  kill -9 $(($nginx_pid+1));
config_load nac

config_get special_ip NAC special_ip
config_get freeall NAC  freeall
service_stop /sbin/nac
killall  -9 check_nac.sh

arptables -F OUTPUT
arptables -F INPUT
arptables -F FORWARD

if [ "$freeall" == "1" ]; then
           sysctl -w net.bridge.bridge-nf-call-arptables=0
    arptables -F FORWARD
    arptables  -P FORWARD  ACCEPT
    exit 
fi
nginx  -c  /usr/local/natshell/nac/https/https_302.conf  -s stop





#/usr/bin/killall  -9 nac  &
#killall  -9 nginx  &
rmmod nackrn.ko  &

if [ "$special_ip" = "0.0.0.0" ] || [ "$special_ip" = "" ] ; then  

    /usr/sbin/iptables  -t nat -D PREROUTING  -p tcp    --dport 80 -m mark --mark 50   -j REDIRECT --to-ports  14150
else
    /usr/sbin/iptables  -t nat -D PREROUTING  -p tcp  -d $special_ip  --dport 80 -m mark --mark 50   -j REDIRECT --to-ports  14150
    /usr/sbin/iptables -t mangle -D PREROUTING -p tcp  ! -d $special_ip  -m mark --mark 50 -j DROP
fi



}





restart() {

        stop_service  
        start_service 
}


